Australian Protective Security Policy Framework (PSPF) compliance software
Assess protective security maturity across the PSPF domains — governance, risk, information, technology, personnel and physical security.
What AU PSPF requires
The Protective Security Policy Framework sets the Australian Government's protective security requirements for non-corporate Commonwealth entities, covering security governance, risk management, information and technology security, personnel security and physical security.
The 2025 Annual Release restructured the framework into consolidated security domains with defined requirements and supporting guidance, replacing the former 16-policy structure. Entities report annually on their maturity and their most significant security risks.
State agencies, contractors and service providers to the Commonwealth frequently align to the PSPF by obligation or by contract, and its information-security expectations connect directly to the Australian ISM assessed under IRAP.
Who it applies to
- Non-corporate Commonwealth entities (mandatory)
- Corporate Commonwealth entities adopting the framework as better practice
- Contractors and service providers handling Australian Government information
- State/territory agencies aligning to Commonwealth protective security
At a glance
- Owner: Department of Home Affairs
- Structure: Security domains with defined requirements (2025 Annual Release)
- Coverage: Governance, risk, information & technology, personnel, physical
- Reporting: Annual maturity self-assessment and reporting
How GRCLens supports AU PSPF
AU PSPF runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
Domain-by-domain assessment
PSPF requirements pre-loaded by security domain, assessed with status, owners, comments and evidence.
Maturity evidence for annual reporting
Dated assessments and artefacts provide the audit trail behind the annual PSPF report.
Connection to the ISM
Technology-security requirements link to Australian ISM controls assessed in the IRAP module, avoiding duplicate evidence.
Owner accountability
CSO and security-adviser roles assign requirements to accountable owners across the entity.
AU PSPF frequently asked questions
Who must comply with the PSPF?
Non-corporate Commonwealth entities must apply it; corporate entities are encouraged to as better practice, and suppliers are frequently bound by contract for the government information they handle.
How does the PSPF relate to the ISM and IRAP?
The PSPF sets protective security policy; the Australian ISM provides detailed cyber controls, commonly assessed through IRAP. GRCLens supports both, with the PSPF assessment referencing ISM evidence where requirements overlap.
Does GRCLens support the 2025 PSPF release?
Yes. The catalogue follows the consolidated domain structure of the 2025 Annual Release.
Can we evidence annual PSPF reporting from the platform?
Yes. Requirement-level status, owners and artefacts give the defensible record behind the entity's annual maturity self-assessment.
One platform, many obligations
Talk to us about AU PSPF
Security Solution Consultants provides Australian government security advisory alongside the platform, so you can combine tooling with hands-on expertise.
Contact us